Free tool · Secure development
Security headers check
Paste your response headers. See at once which protections are missing.
Runs in your browser. Nothing you enter is sent, stored or logged.
Security headers check
Runs entirely in your browser and makes no request to your site. Accepts raw headers or curl output.
Header reading
Paste headers to get a read.
Headers are one layer of a defensible application, and the easiest one to check. The application behind them is where a penetration test earns its fee.
Method
How this works
What it reads
- Pasted response headers, raw or as curl prints them
- HSTS, Content-Security-Policy, framing, X-Content-Type-Options, Referrer-Policy, cookie flags, Permissions-Policy, version disclosure
Sources
- IETF and W3C: RFC 6797 (HSTS), Content Security Policy Level 3, RFC 6265 (cookies).
Version 1.1, 26 Oct 2026.
Limits
- The page makes no request to your site: it reads what you paste.
- Headers are one layer; the application behind them is where a penetration test earns its fee.
Where the engagement goes further
Paste a response and the check parses it in your browser. The page makes no request to your site. Headers are one layer. A web application penetration test exercises the application behind them, where most real findings live.
Talk to us about the full versionShare
Cite this tool, or put it on your site
Cite this tool
A plain citation with the address and the version. Quote the result with the date you ran it.
Black Shard Pty Ltd (2026). Security headers check, version 1.1. https://blackshard.com.au/tools/security-headers-check
Embed it
The frame renders the compact tool. The link under it is a real link on your page, so readers and search engines can follow it here.
Newsroom
Latest in secure development
Free tools
More free tools
Compliance readiness
Essential Eight self-score
Eight strategies, three levels, one question each. See the level each strategy self-scores at.
Free, no sign-upOpen
Breach remediation
Breach notification helper
Walk the Notifiable Data Breaches test the way the OAIC frames it.
Free, no sign-upOpen
Defensive and advisory
Breach cost estimator (Australia)
Your own figures beside the Australian averages, the OAIC breach counts and the Privacy Act maximums.
Free, no sign-upOpen
